RFC: Don't pass a status_code as kwargs in a Field validator

webargs’s ValidationError adds status_code and headers to marshmallow’s ValidationError. This allows to specify a default code for input validation error. The webserver uses this attribute to return the proper error code.

The tests show another use of this that I find a bit problematic.

It is possible to define a validator on a Field of the input validation Schema that raises a ValidationError with a status_code. The deserialization logic in marshmallow adds this attribute to the ValidationError that is raised at the end of the validation process.

The issue with this is the case of several fields raising with a different status code. The last one to deserialize has priority. This is probably a corner case, but it shows the feature is not 100% reliable. It looks underterministic.

In practice I don’t see the use case for this in the first place. I generally use the default 422 for all validation errors and return specific codes from flask abort in view function or in specific decorator (authentication decorator,…).

Related marshmallow issue: https://github.com/marshmallow-code/marshmallow/issues/996.

My suggestion is to remove the logic that passes the kwargs in marshmallow and delete the test case here that exhibit the case of specifying a status code in a field validator.

[lafrech]

We’re using webargs’abort. It accepts kwargs it stores in exception data attribute, so I can pass a message in abort.

That’s two very different ways to address the problem, so it is hard to compare.

But I digress. If you have no objections, let’s go ahead with #338

Yep.

[sloria]

I think you’re right about this, @lafrech . In retrospect, the status_code kwarg was the wrong solution to https://github.com/sloria/webargs/issues/85 . The use case is met by using flask.abort, as you said.

Modified from the OP in #85:

from flask import Flask, abort, Response
from webargs import fields
from webargs.flaskparser import use_args

app = Flask(__name__)


def dummy_validator(val):
    abort(Response("Error!", status=500))


@app.route("/")
@use_args({"test_field": fields.String(validate=dummy_validator)})
def hello_world(args):
    return "Hello World!"

if __name__ == "__main__":
    app.run("0.0.0.0", debug=True)

So let’s move forward with this. It’d be good to have a minor release deprecating status_code and DEFAULT_VALIDATION_STATUS before we remove it in 5.0.0. I might have some time to work on this over the next few days.